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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 
All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . £3 This communication is responsive to Amendment filed on 6/1/07 . 

2. S The allowed claim(s) is/are 1.2.4.5.7 and 8 . 

3. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a) □ All b) □ Some* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

4. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

5. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

6. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 
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INNOCULATION OF COMPUTING DEVICES AGAINST A SELECTED 

COMPUTER VIRUS 

CROSS REFERENCE TO RELATED APPLICATIONS 

This application takes priority under 35 U.S.C. §1 19(e) of U.S. Patent 
Application No 60/481,3 13 filed August 29, 2003 (Attorney Docket No.: 
TRNDP009P) naming Liang et al. as inventor(s) entitled "VIRUS MONITOR AND 
METHODS OF USE THEREOF" which is also incorporated herein by reference for 
all purposes. This application is also related to the following co-pending U.S. Patent 
applications, which are filed concurrently with this application and each of which are 
herein incorporated by reference, (i) U.S. Patent Application No. /° / 6£jf 330 
(Attorney Docket No.: TRNDP009), entitled "VIRUS MONITOR AND METHODS 
OF USE THEREOF" naming Liang et al as inventors; (ii) U.S. Patent Application 
No. /o/6?3S'SJl (Attorney Docket No.: TRNDP010), entitled "AUTOMATIC 
REGISTRATION OF A VIRUS/WORM MONITOR IN A DISTRIBUTED 
NETWORK" naming Liang et al as inventors; (iii) U.S. Patent Application No. 
/4/f?3S7f , (Attorney Docket No.: TRNDP01 1), entitled "NETWORK 
TRAFFIC MANAGEMENT BY A VIRUS/WORM MONITOR IN A 
DISTRIBUTED NETWORK", naming Liang et al as inventors; and (iv) U.S. Patent 
Application No. /^//f^^79 (Attorney Docket No.: TRNDP012), entitled 
"ANTI- VIRUS SECURITY POLICY ENFORCEMENT", naming Liang et al as 
inventors; (v) U.S. Patent Application No. ^/ 6^3 2 73 (Attorney Docket No.: 
TRNDP014), entitled "NETWORK ISOLATION TECHNIQUES SUITABLE FOR 
VIRUS PROTECTION", naming Liang et al as inventors; and (vi) U.S. Patent 
Application No. /<>/6?3S8V (Attorney Docket No.: TRNDP01 5), entitled 



[0054] Accordingly, FIG. 8 illustrates a virus monitor 800 as one 
possible implementation of virus monitor 102. Accordingly, the virus 
monitor 800 includes a traffic controller 802 coupled to network 100 by 
way of a network interface 804 that includes an intruder detection system 
(IDS) module 806 for evaluation of potential intruder attacks described in 

co-pending U.S. Patent Application No. /O , Attorney 

Docket No. 87152491-002027 entitled, "MULTILEVEL VIRUS 
OUTBREAK ALERT BASED ON COLLABORATIVE BEHAVIOR" by 
Liang et al filed _ which is incorporated by 

reference herein in its entirety for all purposes. Such intruder based 
attacks include a Denial of Service (DoS) attack whereby a large number 
of requests are made to a particular server computer within a small period 
of time resulting in the attacked server computer being unable to provide 
access to other, legitimate, requestors. The IDS module 806 determines 
an associated alert level based on the volume of the data traffic flow at 
the virus monitor 800 in a unit time interval which is designated as being 
abnormal if the volume of the data traffic flow is larger than a 
predetermined value in a predetermined time period. 
[0055] Typically, a host base IDS (not shown) sets an alert 

threshold very high in order to reduce the rate of false alarms in detecting 
viruses, which may cause inefficiencies and inflexibilities in dealing with 
virus outbreaks. In contrast, the collaborative anti-virus system adopts 
multilevel alert thresholds, with the highest alert thresholds being 
comparable to those of a host base IDS. Below the highest threshold, at 
least two lower thresholds are maintained in grouping activities at 



